don't include password hash in api responses

Author: aakashg00

packages/db-service/src/modules/auth/auth.controller.ts

@@ -57,7 +57,9 @@ export class ApiKeyDbController
       projectName: request.projectName ?? null,
     });
     return {
-      ...created,
+      id: created.id,
+      email: created.email,
+      name: created.name,
       userType: mapPrismaRoleToRPC(created.userType),
       projectName: created.projectName ?? undefined,
       createdAt: created.createdAt.toISOString(),
@@ -71,7 +73,9 @@ export class ApiKeyDbController
     const requests = await this.apiKeyService.getAllAccountRequests();
     return {
       requests: requests.map((req) => ({
-        ...req,
+        id: req.id,
+        email: req.email,
+        name: req.name,
         userType: mapPrismaRoleToRPC(req.userType),
         projectName: req.projectName ?? undefined,
         createdAt: req.createdAt.toISOString(),
@@ -84,7 +88,9 @@ export class ApiKeyDbController
   ): Promise<UserProto.NewAccountRequest> {
     const removed = await this.apiKeyService.deleteAccountRequest(request.id);
     return {
-      ...removed,
+      id: removed.id,
+      email: removed.email,
+      name: removed.name,
       userType: mapPrismaRoleToRPC(removed.userType),
       projectName: removed.projectName ?? undefined,
       createdAt: removed.createdAt.toISOString(),

packages/db-service/test/auth.e2e-spec.ts

@@ -196,27 +196,6 @@ describe('DB Service Account Request Tests', () => {
     expect(resp['createdAt']).toBeDefined();
   });
 
-  it('hashes the password when creating a request', async () => {
-    const rawPassword = 'plaintext-password';
-    const resp: any = await new Promise((resolve) => {
-      accountRequestClient.createAccountRequest(
-        {
-          email: 'hashcheck@test.com',
-          name: 'Hash Check',
-          password: rawPassword,
-          userType: 'USER',
-        },
-        (err, resp) => {
-          expect(err).toBeNull();
-          resolve(resp);
-        },
-      );
-    });
-
-    expect(resp['password']).toBeDefined();
-    expect(resp['password']).not.toBe(rawPassword);
-  });
-
   it('gets all account requests', async () => {
     await new Promise((resolve) => {
       accountRequestClient.createAccountRequest(

packages/proto/definitions/user.proto

@@ -85,10 +85,9 @@ message NewAccountRequest {
   int32 id = 1;
   string email = 2;
   string name = 3;
-  string password = 4;
-  common.UserType userType = 5;
-  optional string projectName = 6;
-  string createdAt = 7;
+  common.UserType userType = 4;
+  optional string projectName = 5;
+  string createdAt = 6;
 }
 
 message NewAccountRequests {